Disclosed vulnerability
Prompt injection to RCE and sandbox escape in Antigravity: the find_by_name tool interpolates the Pattern parameter straight into fd, allowing -X exec-batch injection
AIR-2026-0092 AIR record · 2026-04-google-antigravity-fd-exec-rce
From the supporting source
Native tool invocations are executed by the agent directly, before Secure Mode's command-level restrictions are evaluated.pillar.security
The record
Disclosed
2026-04-20
Vendor
Google
Product
Google Antigravity
Risk domain
Access control and permissions › Privilege escalation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the agent's file-search tool executed injected -X exec-batch commands
Attack surface
Coding agent
Autonomy level
Copilot with approval
Initial vector
Indirect prompt injection to tool parameter injection
Impact type
Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Antigravity users, including those running the most restrictive Secure Mode
Capability abused
Defense & remediation
Recorded defense
Antigravity Secure Mode command-level restrictions
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
fixed by Google 2026-02-28; bounty 2026-03-26
Taxonomy & references
Curator notes
Pillar Security (Dan Lisichkin). Reported 2026-01-07, fixed 2026-02-28, published 2026-04-20. The generalizable lesson: a command-approval policy that sits in front of shell invocations does nothing about the agent's own built-in tools, and those tools shell out. Distinct from 2025-11-google-antigravity-vulnerabilities and 2026-07-google-antigravity-tasks-json-timebomb.
Supporting sources
Cite as
Enkrypt AI. "Prompt injection to RCE and sandbox escape in Antigravity: the find_by_name tool interpolates the Pattern parameter straight into fd, allowing -X exec-batch injection". AIR, AIR-2026-0092. https://agentincident.vercel.app/i/AIR-2026-0092/ (accessed 2026-10-19).